Mgr IT Security I

IGT, a Nevada Corporation•Paradise, NV

12d•$120,000 - $180,000•Onsite

About The Position

Lead the team that protects IGT’s global environment from cyber threats. As Manager, Security Operations, you’ll lead and develop security analysts responsible for detecting, investigating and responding to threats across the business. This is a hands-on leadership role: you’ll set operational priorities, guide complex investigations and take an active role during major incidents. You’ll advance our detection, automation, response playbooks and intelligence-driven threat hunting capabilities while building strong relationships across IT, Legal, Compliance and the business.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems or a related field, or equivalent practical experience.
Seven or more years of cybersecurity experience, including at least three years leading a SOC or incident response analyst team.
Demonstrated ability to develop analysts, set operational priorities and maintain effective security operations.
Hands-on experience investigating and responding to account compromise, phishing, ransomware and malware incidents.
Strong knowledge of SIEM, EDR/XDR, SOAR and email security platforms, with practical experience applying MITRE ATT&CK to detection, investigation and response.
Clear communication skills and the ability to support an affected employee, coordinate technical responders and brief executives.
Sound judgment under pressure, including the ability to make timely decisions with incomplete information.

Responsibilities

Manage, mentor and develop security analysts, with responsibility for hiring, coaching, performance management and career development.
Set priorities for daily operations and establish clear standards for investigation quality, response times and escalation.
Lead or support incidents from detection through containment, eradication, recovery and lessons learned, following established incident response frameworks and procedures.
Serve as a primary coordination point during major incidents, communicating business impact, response progress and key decisions to executives, Legal and Compliance.
Coordinate response activities with IT, business teams and external partners, including forensic specialists, law enforcement and customer security teams when appropriate.
Drive root cause analysis, track corrective actions through completion, and maintain and exercise incident response plans, playbooks, runbooks and escalation procedures.
Partner with security engineering to improve SIEM, EDR/XDR and email security detections using findings from investigations, threat intelligence and analyst feedback.
Identify opportunities to automate repetitive work and develop SOAR workflows that improve response speed, consistency and analyst capacity.
Use MITRE ATT&CK to assess detection coverage, prioritize gaps and validate improvements.
Translate threat intelligence and emerging attacker techniques into targeted hunts, detection requirements and response actions.
Evolve response capabilities for AI-enabled threats, including deepfake impersonation, AI-generated phishing and automated attacks.
Help validate defenses through purple team exercises and adversary simulations.
Manage the operational relationship with the managed SOC partner, including service performance, SLAs, escalation quality and handoffs.
Support the data loss prevention program through policy tuning, alert review and investigations into potential data exposure.
Work with business owners to implement practical data protection measures that support everyday work.
Provide clear, responsive support to employees reporting suspicious activity or affected by security incidents.
Translate technical findings into understandable risks, business impacts and recommended actions.
Strengthen security awareness using lessons from real incidents and emerging threats.
Track and report measures such as time to detect and contain threats, investigation quality, alert trends and automation effectiveness.
Use operational data to prioritize improvements, inform staffing and investment decisions, and demonstrate the value of security operations.
Support security operations requirements for PCI DSS and SOC 2, including maintaining procedures and providing audit evidence.